Should we form an entity? When? What kind?

Inventory university offices/programs that have “notification” responsibilities. Which ones are mandated by law? Which ones are regulated? Which ones are mission critical vs. "convenience”?
Inventory the software tools we used and identify licensing/permissions on each one EXPLICITLY.
Inventory our DATA sources: what are terms of use on each of these? Which ones are we skating on thin ice with?
We should learn a little something about FERPA (Family Educational Rights and Privacy Act). For example start here.
Think about the principles we want to embed in TommyBot’s privacy practices beyond what might be required by law or university rules.
What does the liability landscape look like for us? As a conveyor of information from other sources? As a matching service (between questions and answers)?
What sort of contract should we have with a customer like USC?
How should we formalize the understanding we have on the team in the spirit of proactively avoiding conflict later?